Skip to content

Commit 3a9829a

Browse files
rdlowreyrdlowrey
committed
Use crypto method flags; add tlsv1.0 wrapper; add wrapper tests
1 parent d0c9207 commit 3a9829a

12 files changed

Lines changed: 569 additions & 164 deletions

‎ext/openssl/openssl.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1224,6 +1224,7 @@ PHP_MINIT_FUNCTION(openssl)
12241224
php_stream_xport_register("sslv2", php_openssl_ssl_socket_factory TSRMLS_CC);
12251225
#endif
12261226
php_stream_xport_register("tls", php_openssl_ssl_socket_factory TSRMLS_CC);
1227+
php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory TSRMLS_CC);
12271228
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
12281229
php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory TSRMLS_CC);
12291230
php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory TSRMLS_CC);
@@ -1269,6 +1270,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
12691270
#endif
12701271
php_stream_xport_unregister("sslv3" TSRMLS_CC);
12711272
php_stream_xport_unregister("tls" TSRMLS_CC);
1273+
php_stream_xport_unregister("tlsv1.0" TSRMLS_CC);
12721274
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
12731275
php_stream_xport_unregister("tlsv1.1" TSRMLS_CC);
12741276
php_stream_xport_unregister("tlsv1.2" TSRMLS_CC);

‎ext/openssl/tests/stream_crypto_flags_001.phpt‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
--TEST--
2+
Basic bitwise stream crypto context flag assignment
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (!function_exists('pcntl_fork')) die("skip no fork");
7+
--FILE--
8+
<?php
9+
$flags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
10+
$ctx = stream_context_create(['ssl' => [
11+
'local_cert' => __DIR__ . '/bug54992.pem',
12+
'allow_self_signed' => true
13+
]]);
14+
$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
15+
var_dump($server);
16+
17+
$pid = pcntl_fork();
18+
if ($pid == -1) {
19+
die('could not fork');
20+
} else if ($pid) {
21+
22+
// Base SSL context values
23+
$sslCtxVars = array(
24+
'verify_peer' => TRUE,
25+
'cafile' => __DIR__ . '/bug54992-ca.pem',
26+
'CN_match' => 'bug54992.local', // common name from the server's "local_cert" PEM file
27+
);
28+
29+
// SSLv3
30+
$ctxCopy = $sslCtxVars;
31+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_SSLv3_CLIENT;
32+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
33+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
34+
35+
// TLSv1
36+
$ctxCopy = $sslCtxVars;
37+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT;
38+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
39+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
40+
41+
// TLS (any)
42+
$ctxCopy = $sslCtxVars;
43+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLS_CLIENT;
44+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
45+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
46+
47+
} else {
48+
@pcntl_wait($status);
49+
@stream_socket_accept($server, 1);
50+
@stream_socket_accept($server, 1);
51+
@stream_socket_accept($server, 1);
52+
}
53+
--EXPECTF--
54+
resource(%d) of type (stream)
55+
resource(%d) of type (stream)
56+
resource(%d) of type (stream)
57+
resource(%d) of type (stream)
58+

‎ext/openssl/tests/stream_crypto_flags_002.phpt‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
--TEST--
2+
TLSv1.1 and TLSv1.2 bitwise stream crypto flag assignment
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (!function_exists('pcntl_fork')) die("skip no fork");
7+
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
8+
--FILE--
9+
<?php
10+
$flags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(['ssl' => [
12+
'local_cert' => __DIR__ . '/bug54992.pem',
13+
'allow_self_signed' => true
14+
]]);
15+
$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
16+
var_dump($server);
17+
18+
$pid = pcntl_fork();
19+
if ($pid == -1) {
20+
die('could not fork');
21+
} else if ($pid) {
22+
23+
// Base SSL context values
24+
$sslCtxVars = array(
25+
'verify_peer' => TRUE,
26+
'cafile' => __DIR__ . '/bug54992-ca.pem',
27+
'CN_match' => 'bug54992.local', // common name from the server's "local_cert" PEM file
28+
);
29+
30+
// TLSv1
31+
$ctxCopy = $sslCtxVars;
32+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT;
33+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
34+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
35+
36+
// TLSv1.1
37+
$ctxCopy = $sslCtxVars;
38+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
39+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
40+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
41+
42+
// TLSv1.2
43+
$ctxCopy = $sslCtxVars;
44+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
45+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
46+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
47+
48+
// TLS (any)
49+
$ctxCopy = $sslCtxVars;
50+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLS_CLIENT;
51+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
52+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
53+
54+
} else {
55+
@pcntl_wait($status);
56+
@stream_socket_accept($server, 1);
57+
@stream_socket_accept($server, 1);
58+
@stream_socket_accept($server, 1);
59+
@stream_socket_accept($server, 1);
60+
}
61+
--EXPECTF--
62+
resource(%d) of type (stream)
63+
resource(%d) of type (stream)
64+
resource(%d) of type (stream)
65+
resource(%d) of type (stream)
66+
resource(%d) of type (stream)
67+

‎ext/openssl/tests/stream_crypto_flags_003.phpt‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
--TEST--
2+
Server bitwise stream crypto flag assignment
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (!function_exists('pcntl_fork')) die("skip no fork");
7+
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
8+
--FILE--
9+
<?php
10+
$flags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(['ssl' => [
12+
'local_cert' => __DIR__ . '/bug54992.pem',
13+
'allow_self_signed' => true,
14+
15+
// Only accept SSLv3 and TLSv1.2 connections
16+
'crypto_method' => STREAM_CRYPTO_METHOD_SSLv3_SERVER | STREAM_CRYPTO_METHOD_TLSv1_2_SERVER
17+
]]);
18+
$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
19+
var_dump($server);
20+
21+
$pid = pcntl_fork();
22+
if ($pid == -1) {
23+
die('could not fork');
24+
} else if ($pid) {
25+
26+
// Base SSL context values
27+
$sslCtxVars = array(
28+
'verify_peer' => TRUE,
29+
'cafile' => __DIR__ . '/bug54992-ca.pem',
30+
'CN_match' => 'bug54992.local', // common name from the server's "local_cert" PEM file
31+
);
32+
33+
// TLSv1.2
34+
$ctxCopy = $sslCtxVars;
35+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
36+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
37+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
38+
39+
// SSLv3
40+
$ctxCopy = $sslCtxVars;
41+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_SSLv3_CLIENT;
42+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
43+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
44+
45+
// TLSv1 (should fail)
46+
$ctxCopy = $sslCtxVars;
47+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT;
48+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
49+
var_dump(@stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
50+
51+
// TLSv1.1 (should fail)
52+
$ctxCopy = $sslCtxVars;
53+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
54+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
55+
var_dump(@stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, STREAM_CLIENT_CONNECT, $ctx));
56+
57+
} else {
58+
@pcntl_wait($status);
59+
@stream_socket_accept($server, 1);
60+
@stream_socket_accept($server, 1);
61+
}
62+
--EXPECTF--
63+
resource(%d) of type (stream)
64+
resource(%d) of type (stream)
65+
resource(%d) of type (stream)
66+
bool(false)
67+
bool(false)
68+

‎ext/openssl/tests/stream_crypto_flags_005.phpt‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
--TEST--
2+
Specific protocol method specification
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (!function_exists('pcntl_fork')) die("skip no fork");
7+
--FILE--
8+
<?php
9+
$flags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
10+
$ctx = stream_context_create(['ssl' => [
11+
'local_cert' => __DIR__ . '/bug54992.pem',
12+
'allow_self_signed' => true,
13+
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_0_SERVER
14+
]]);
15+
16+
$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
17+
var_dump($server);
18+
19+
$pid = pcntl_fork();
20+
if ($pid == -1) {
21+
die('could not fork');
22+
} else if ($pid) {
23+
24+
// Base SSL context values
25+
$sslCtxVars = array(
26+
'verify_peer' => FALSE,
27+
'cafile' => __DIR__ . '/bug54992-ca.pem',
28+
'CN_match' => 'bug54992.local', // common name from the server's "local_cert" PEM file
29+
);
30+
31+
// Should fail because the SSLv23 hello method is not supported
32+
$ctxCopy = $sslCtxVars;
33+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
34+
var_dump(@stream_socket_client("ssl://127.0.0.1:64321"));
35+
36+
// Should fail because the TLSv1.1 hello method is not supported
37+
$ctxCopy = $sslCtxVars;
38+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
39+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
40+
var_dump(@stream_socket_client("ssl://127.0.0.1:64321"));
41+
42+
// Should fail because the TLSv1.2 hello method is not supported
43+
$ctxCopy = $sslCtxVars;
44+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
45+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
46+
var_dump(@stream_socket_client("ssl://127.0.0.1:64321"));
47+
48+
// Should succeed because we use the same TLSv1 hello
49+
$ctxCopy = $sslCtxVars;
50+
$ctxCopy['crypto_method'] = STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT;
51+
$ctx = stream_context_create(array('ssl' => $ctxCopy));
52+
var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $ctx));
53+
54+
} else {
55+
@pcntl_wait($status);
56+
@stream_socket_accept($server, 1);
57+
@stream_socket_accept($server, 1);
58+
@stream_socket_accept($server, 1);
59+
@stream_socket_accept($server, 1);
60+
}
61+
--EXPECTF--
62+
resource(%d) of type (stream)
63+
bool(false)
64+
bool(false)
65+
bool(false)
66+
resource(%d) of type (stream)
67+

‎ext/openssl/tests/streams_crypto_method.phpt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,4 +56,3 @@ EOS;
5656
?>
5757
--EXPECTF--
5858
Hello World!
59-

‎ext/openssl/tests/tlsv1.0_wrapper.phpt‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--TEST--
2+
tlsv1.0 stream wrapper
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSL 1.0.1 required");
7+
if (!function_exists('pcntl_fork')) die("skip no fork");
8+
--FILE--
9+
<?php
10+
$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(array('ssl' => array(
12+
'local_cert' => __DIR__ . '/streams_crypto_method.pem',
13+
)));
14+
15+
$server = stream_socket_server('tlsv1.0://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
16+
var_dump($server);
17+
18+
$pid = pcntl_fork();
19+
if ($pid == -1) {
20+
die('could not fork');
21+
} elseif ($pid) {
22+
$flags = STREAM_CLIENT_CONNECT;
23+
$ctx = stream_context_create(array('ssl' => array(
24+
'verify_peer' => false,
25+
'verify_host' => false
26+
)));
27+
28+
$client = stream_socket_client("tlsv1.0://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
29+
var_dump($client);
30+
31+
$client = @stream_socket_client("sslv3://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
32+
var_dump($client);
33+
34+
$client = @stream_socket_client("tlsv1.2://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
35+
var_dump($client);
36+
37+
} else {
38+
@pcntl_wait($status);
39+
for ($i=0; $i < 3; $i++) {
40+
@stream_socket_accept($server, 1);
41+
}
42+
}
43+
--EXPECTF--
44+
resource(%d) of type (stream)
45+
resource(%d) of type (stream)
46+
bool(false)
47+
bool(false)

‎ext/openssl/tests/tlsv1.1_wrapper.phpt‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--TEST--
2+
tlsv1.1 stream wrapper
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSL 1.0.1 required");
7+
if (!function_exists('pcntl_fork')) die("skip no fork");
8+
--FILE--
9+
<?php
10+
$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(array('ssl' => array(
12+
'local_cert' => __DIR__ . '/streams_crypto_method.pem',
13+
)));
14+
15+
$server = stream_socket_server('tlsv1.1://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
16+
var_dump($server);
17+
18+
$pid = pcntl_fork();
19+
if ($pid == -1) {
20+
die('could not fork');
21+
} elseif ($pid) {
22+
$flags = STREAM_CLIENT_CONNECT;
23+
$ctx = stream_context_create(array('ssl' => array(
24+
'verify_peer' => false,
25+
'verify_host' => false
26+
)));
27+
28+
$client = stream_socket_client("tlsv1.1://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
29+
var_dump($client);
30+
31+
$client = @stream_socket_client("sslv3://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
32+
var_dump($client);
33+
34+
$client = @stream_socket_client("tlsv1.2://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
35+
var_dump($client);
36+
37+
} else {
38+
@pcntl_wait($status);
39+
for ($i=0; $i < 3; $i++) {
40+
@stream_socket_accept($server, 1);
41+
}
42+
}
43+
--EXPECTF--
44+
resource(%d) of type (stream)
45+
resource(%d) of type (stream)
46+
bool(false)
47+
bool(false)

0 commit comments

Comments
 (0)